HIPAA basics for practice marketing

You don’t need to be a privacy lawyer to market a dental practice safely, but everyone who touches marketing needs a working understanding of a few HIPAA ideas. Most mistakes happen because someone didn’t realize the information in front of them was protected.

What protected health information means in marketing

Protected health information (PHI) is information that identifies a person and relates to their health, their care or payment for it. In marketing terms, that is broader than most people expect:

• The fact that someone is your patient is itself protected. A name on your patient list, a reply that says “great to see you last week” or a photo taken in the chair all reveal it.
• Contact details from your practice software are protected once they are tied to the practice, even without any treatment information.
• Appointment types, treatments, balances and recall status are protected, so a list of “patients due for a cleaning” or “patients with unscheduled implants” is sensitive.
• Photos, x-rays, scans and smiles can identify a patient, even when the face isn’t shown.

Who HIPAA covers

A dental practice that bills insurance electronically is a covered entity. Companies that handle PHI on the practice’s behalf, such as some marketing agencies, email and texting platforms and call-tracking services, are generally business associates and need a signed agreement with the practice. That is covered in vendors and business associate agreements. The practice also needs a designated privacy officer and workforce training, and marketing belongs in both.

What HIPAA calls “marketing”

HIPAA has its own definition of marketing, and it doesn’t match the everyday meaning. Stated conservatively:

• Communications about the patient’s own care, such as appointment reminders, recall notices and treatment follow-ups, are generally treatment communications rather than HIPAA marketing.
• Telling your own patients about your own services, such as a newsletter about the practice or a note that you now offer clear aligners, is generally not HIPAA marketing either, as long as no outside company is paying you to send it.
• When a third party pays or gives the practice something in return for sending a message that promotes its product, the message generally becomes marketing and needs each patient’s written authorization.
• Selling or sharing patient information with another company for its own marketing generally requires authorization and is something a practice should simply not do.

Even when authorization isn’t required, other rules still apply: texting consent, email opt-outs, state dental board advertising rules and your patients’ trust. The definitions have exceptions and details, so run anything unusual, especially anything sponsored, past your privacy officer or a healthcare attorney.

State law can add more

HIPAA sets a federal floor. Some states have their own medical privacy laws or consumer health data laws, and some of these reach information HIPAA doesn’t, such as data collected from website visitors. Ask your attorney which state rules apply to your practice, especially if you have locations in more than one state.